Privacy Policy

Effective 2026-10-28 · Terms of Service · Home

Recoop is a price-adjustment assistant. It watches the Costco.com orders you forward to it. When a price drops inside Costco's adjustment window, it emails you, so you can ask Costco for the difference.

Recoop is run by one person — the operator ("we", "us"). It is a closed beta, offered only in the United States. You apply on our website, and the operator invites people by hand. A legal entity will be named here before public launch.

This policy covers the Recoop website and app, your private Recoop forwarding address, the emails we send you, and the Recoop Collector extension for Chrome.

The short version

• We collect your email address when you sign in. That is the whole account.
• If you choose Google sign-in, Google gives us your email, name and profile picture link. We ask for nothing else — no Gmail access.
• You get a private forwarding address. You set up a Gmail filter that forwards Costco order emails to it. Software reads those emails to record what you bought and to spot refunds. We never see the rest of your inbox.
• The Chrome extension checks current prices for watched items on costco.com from your browser. It works only while you are signed in, and it sends us item numbers and prices linked to your account. It does not send the pages you visit, your Costco account, your orders or your Costco cookies.
• We use all of this for one purpose: finding price drops on things you bought and telling you.
• We do not sell your information. We show no ads. We do not use your data to train AI models.
• Three companies process data for us: Postmark (email), Hetzner (servers, in Germany) and Google (sign-in, and the typefaces on every page).
• Raw copies of forwarded emails are deleted after 30 days (395 days when an email proved a refund). Postmark keeps its own copy of each email we send or receive for 45 days. The other periods are under "Retention and deletion".
• You can pause alert email with one click, and you can request deletion of your data. A person handles deletion within 30 days and confirms by email.
• Questions: ops@tryrecoop.com.

What we collect

Your account and sign-in. You sign in with a one-time link we email you. There is no password. We store: your email address; when you first signed in and when your address was verified; a random token that is the key to your email-preferences page; and a record for each browser where you are signed in. A session record holds a random session token, its expiry (7 days, refreshed while you use it), and the IP address and browser identifier (user agent) of that session. Session records are deleted within 30 days after they expire.

If you apply for the beta. On the application page you enter your email address and tick a box to accept our terms and this policy. We store the address, the time, the version of the terms and policy you accepted, and the IP address and browser identifier (user agent) of that request. We then send you an email asking you to confirm the address; the link works for 24 hours. If the link has expired, you can ask for a new one on the same page. We send at most one confirmation email per address per day, however many times someone asks. If nobody confirms, the operator never sees the request, and we delete it within 30 days. If someone else entered your address, you get at most one email a day and nothing else; its "stop these emails" link blocks all further application email to your address, including new confirmation links.

If you are approved. The operator reviews each confirmed request and decides by hand. If the operator approves, your address goes on our invitation list and we email you an invitation; only invited addresses can create an account. If the invitation did not reach you, the operator can send it again, at most once a day. We record when and how many times each of these emails was sent. If the operator declines, we send no email and delete the request within 30 days.

Email you forward to your Recoop address. When you first sign in with a Gmail address, we create a private forwarding address for you: a random 32-character name on our inbound mail domain. You add it as a forwarding address in Gmail, and you create a filter that forwards mail from Costco's two order senders (orders.costco.com and order-refund@costco.com). Addresses that are not Gmail get no forwarding address today.

The one thing our server does inside your Google settings: when you add the forwarding address, Google emails a confirmation to it. Our server submits that confirmation for you, so you do not have to copy a code. That submission tells Google "yes, forward mail here". It does nothing else, and you can remove the forwarding address in Gmail at any time.

Mail sent to your forwarding address is processed by software, not by a person, in this order:

1. We check that the address belongs to a Recoop account. If it does not, we do not process the message or keep its content. We keep only a short record: the unknown address, the addresses on the message's "To" line and the time. The record stays in our audit events for 90 days and in our server log for about 30 days. Postmark's own 45-day copy still applies (see "Who processes it for us"). This also happens to mail that a Gmail filter still forwards after you delete your account.
2. We classify the message by sender and subject: an order confirmation, a price-adjustment refund, a return refund, a denial, Gmail's own confirmation message, or "other".
3. We check the message's email-authentication results (DKIM and SPF). We trust an order or a refund only when it is authenticated Costco mail.
4. For every message that reaches a known address, we keep a metadata row: a message ID, the sender's domain, the authentication results, the classification and the time received.
5. For authenticated Costco messages only, we also keep the full raw message (headers, text and HTML) for 30 days, so we can re-process it if our parser has a bug. When a message verified a refund, we keep it for 395 days as the receipt behind that refund. Then it is deleted.
6. For messages classified "other" — anything that is not Costco order mail — we keep only the metadata row, never the content. Postmark's own 45-day copy still applies. We count them: if five arrive in seven days, we flag that your filter may forward too much, so we can warn you.

From order confirmations we extract and store: the order number; each item's Costco item number, title, unit price and quantity; the purchase date; the product page link; and the last four digits of the paying card when Costco prints them (Costco's current emails do not). From refund emails we extract the refund amount and the order it applies to. From these we build your purchase list and the price-drop and refund records that follow.

Google sign-in data. See "Google sign-in" below.

Chrome extension data. See "Chrome extension" below.

Feedback you send us. The app has a feedback form. Using it is optional. When you send feedback, we store your message, the time you sent it, and the browser identifier (user agent) of the request, so we can reproduce a bug. You may attach one screenshot. What it shows is your choice: it may include your Costco order history, prices or anything else on your screen, so crop out what you do not want us to see. We store the screenshot as you sent it. Only the operator sees feedback, on an operator-only page; nobody else receives it. A copy of your message — never the screenshot — is also emailed to the operator, so it is seen quickly. We use feedback to fix bugs and improve the service, and to reply to you by email when needed. The screenshot is deleted 90 days after you send it. The message is kept with your account and is deleted with it.

Technical data, logs and audit events.

• Server logs. Like every web server, ours logs each request: time, path, status, response time and the client IP address. Logs are kept about 30 days. We add no analytics, advertising or cross-site tracking scripts to any page. One script of our own reports page errors to us; see "Error reports" below. Every page does load its typefaces from Google Fonts; fetching them tells Google your IP address, not which page you are on (see "Who processes it for us").
• Audit events. Our software writes an internal event when something notable happens: a parse failure, a rejected forged email, a suspicious price, an email-preference change, a deletion request, a feedback submission (the fact, not your message). Events carry a request ID and a short detail, such as an item number or an error; a few carry an email address (for example, for mail sent to an unknown forwarding address). Events are deleted after 90 days.
• Error reports. When something breaks — a page script fails, a request to our server fails, or the extension hits an error — our software sends a report to an error store that we run on our own server. No other company receives it. A report carries: the error's name and message, the place in our own code where it happened, the time, the version of our software, your browser and operating system versions, and the request ID of the failed request, which lets us find the matching line in our server log. A report about a failure on our server while you were signed in also carries the internal number of your account, never your email address. A report from one of our web pages also carries the last few steps before the error: the pages opened, the requests made and the buttons clicked, as element names. A report never carries your email address, your session cookie, the content of any email, anything you typed, the content or address of any costco.com page, or your IP address. We strip these before a report leaves your browser, and again on our server. We use reports only to fix bugs. Each report is deleted 30 days after it arrives.
• Log of email we sent. We record each email we send: its type, the time, whether our email provider accepted it, the provider's message ID, and the account or beta application it belongs to. The log holds neither the address nor the content. It is deleted after 30 days.
• Cookies. We set one cookie: the session cookie, only after you sign in. It is HttpOnly, Secure and SameSite=Lax, and it expires after 7 days without use. There are no advertising or analytics cookies.
• The button in price-drop emails goes through our server before it opens Costco's price-adjustment page. We record the first time a person clicks it, per alert, to learn whether alerts are useful. Automated link scanners are ignored.
• The logo in our emails loads from our server. When your mail app loads it, our server log records that request like any other request. We do not use it to track opens.

Why we collect it

We use the data above to:

1. sign you in and keep your session;
2. create and run your forwarding address;
3. turn Costco order emails into a list of things you bought, with prices and dates;
4. compare those prices with current prices and decide, by Costco's published rules plus our own thresholds, whether a drop is worth telling you about;
5. email you about a drop and, later, whether Costco's refund arrived;
6. keep the service secure and stop abuse (authentication checks, rate limits, device bans);
7. fix bugs and measure whether the service works (error reports, and aggregate counts such as sign-ups, drops found and refunds verified);
8. answer you when you write to us or send feedback, and use that feedback to improve the service.

We never: sell your information; share it for advertising; use your emails or any other data to train AI or machine-learning models; track you across other websites; or use your Costco data for anything but the features above. If we ever want to use data for a new purpose, we will update this policy and ask you first.

Google sign-in

Google sign-in is optional; the email link always works.

• We ask Google for three permissions only: openid, email and profile. They give us your Google account email, your name and the link to your profile picture.
• We store your email, name and picture link in our sign-in database. We do not display the picture today.
• Google also hands our sign-in software an access token and an ID token. The access and refresh tokens are stored encrypted; the sign-in (ID) token is stored with your account record. They are used only to sign you in. They give us no access to Gmail or to any other Google service.
• We never ask for Gmail permissions. Forwarding is something you set up inside Gmail yourself. Recoop cannot read your inbox, your filters or your settings.
• Google sign-in works only for an address on our invitation list. If your Google address is on the list, your first Google sign-in creates your Recoop account, as the email link does.
• You can remove Recoop's access at any time at https://myaccount.google.com/permissions. Removing it does not delete your account; see "Retention and deletion".
• Recoop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Chrome extension

The Recoop Collector extension is optional. It checks Costco prices from your browser. It works only while you are signed in to Recoop in the same browser, and what it sends us is linked to your account.

What each request carries. Every request the extension makes to our server carries the extension's version, an install ID and, if you are signed in, your session cookie. The install ID is a random code that the extension creates on first use and keeps in your browser. When you are signed in, each request also creates or updates one install record, linked to your account: a one-way hash of the install ID, the extension version, the browser type and the time of the last request. Like every request to our server, it also appears in our server log with your IP address (see "Technical data, logs and audit events").

About every six hours while Chrome is open, once it has the three Costco identifiers described below, the extension:

• asks our server for a list of Costco item numbers that some Recoop user bought recently — at most 50 per check, with no names, no order data and nothing that says who bought what;
• fetches each item's current price from Costco's public price service, from your browser, 2 to 5 seconds apart;
• sends us, for each item: the item number, the price, whether it is in stock, and any promotion end date. For items it could not price, it sends the item number and a failure reason.

To call Costco's price service, the extension needs three identifiers that every costco.com page embeds: an API client identifier, a client ID and your selected warehouse number. A small script reads them from the HTML of any costco.com page you visit and keeps them in the extension's local storage on your computer. They are sent only to Costco's price service, never to us.

The extension never sends us or keeps: the pages or URLs you visit, your search history, your Costco account or order details, your Costco cookies or session tokens, or anything you type. The small script reads the HTML of each costco.com page you open, including account and order pages, only to find the three identifiers; it keeps those three and nothing else. The extension fills no forms and clicks nothing. Its only permissions are local storage and timers, plus access to www.costco.com, Costco's price service and our own website and API. It does not run on any other site.

Prices reported by any user's extension are pooled: one person's check can find a drop for everyone who bought that item. The pool holds item numbers, prices, stock, promotion end dates and times. Each price also keeps a link to the install record that reported it, so we can find and exclude bad data. While your account exists, that link ties the prices your extension reported to your account. When your account is deleted, we remove the link and keep the prices.

Your dashboard. Your Recoop dashboard asks the extension directly, inside Chrome, whether it is installed and signed in. Uninstalling the extension removes it and its local storage from your browser. The install record on our server stays with your account until the account is deleted.

Error reports from the extension. If the extension hits an error, it sends us a report through our API: the error's name and message, the place in the extension's code, the extension version, your browser version and, when the error concerns a price check, the item number. The extension never reports anything about the page you were on. A report never includes the page's address or content, the three Costco identifiers, your Costco cookies, your session cookie or anything you typed, and the extension records no clicks or page visits for it. Reports are handled as described under "Error reports" above and deleted after 30 days.

Data received from the extension is used only to provide the price-drop feature described here. We do not sell it, use it for advertising or credit decisions, or transfer it to data brokers. The extension's use of user data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Who processes it for us

We share personal information only with:

• Postmark (AC PM, LLC, part of ActiveCampaign; United States) — delivers our outgoing email and receives mail sent to your forwarding address. Postmark keeps its own copy of each message's content and delivery events for 45 days. Then Postmark deletes them. If an email to you fails permanently, Postmark puts your address on a do-not-send list, with the reason and the date. It does the same if your mail provider tells Postmark that you marked one of our emails as spam. Postmark keeps these entries with no end date.
• Hetzner Online GmbH (Germany) — runs our servers, database and backups. Our servers are located in Germany; by using Recoop you agree that your information is stored there.
• Cloudflare — provides DNS for our domain names only. It does not proxy or see your traffic.
• Google — for Google sign-in, if you use it (see "Google sign-in"), and for the typefaces on every page. Every page, including this one, loads its typefaces from Google Fonts, so this applies to every visitor, signed in or not. Google receives your IP address and the standard headers your browser sends with any request, such as which browser and operating system you use. It can tell the request comes from our site, but not which page you are on. Google says it sets no cookies for these requests and that they are separate from any Google account you are signed in to. It also says it does not use them to profile you or to target ads.
• Costco's public price service — receives item numbers and the three page identifiers from your browser, not from us, when the extension checks prices. Costco receives nothing about you from Recoop.
• Authorities or other parties when the law requires it, or when we reasonably believe it is needed to protect someone's safety, to stop fraud or abuse, or to enforce our terms. We will tell you when we are allowed to.
• A successor, if Recoop is ever sold or merged. Your data would stay under this policy, or you would be told first and given a choice.

One person operates Recoop today. That person can see stored data when needed to run the service, fix a problem or handle your request. Nobody else has access.

Retention and deletion

Your choices.

• Pause email. Use the "Manage email preferences" link at the bottom of our alerts, setup and status emails, or your mail app's Unsubscribe button on an alert. Pausing stops alerts and status email; it never deletes your data, and you can resume at any time. We will still email you legal notices — a change to this policy or our terms, a warning before we close an inactive account, or the confirmation of your deletion — because you need to know those things.
• Stop application email. The confirmation and invitation emails carry a link that stops all further email about a beta application; the invitation also supports your mail app's one-click Unsubscribe. Stopping application email does not cancel an invitation and does not affect an account you already have.
• Delete your data. On the same preferences page, tap Request data deletion. A person removes your account, forwarding address, stored emails, purchases, claims and sign-in records within 30 days, then sends one confirmation email. After that, remember to delete the Gmail filter and forwarding address on your side; we cannot do that for you. Postmark deletes its own copies of emails to and from you 45 days after each email.
• Uninstall the extension from Chrome's extensions page. That removes it and its local storage. The install record on our server stays with your account until the account is deleted.
• See or fix your data. Email ops@tryrecoop.com from your account address. We will send you what we hold, or correct it, within 30 days.
• Google sign-in. Remove Recoop at https://myaccount.google.com/permissions.
• We never treat anyone worse for using these rights.

Security

• Everything travels over HTTPS.
• Extension install IDs are stored only as one-way hashes. Sign-in links are single-use and expire in minutes. Google sign-in access and refresh tokens are stored encrypted.
• We hold no Costco password, cookie or session — not on our servers, not in the extension.
• We believe a refund happened only when Costco's own email passes authentication checks (DKIM). Forged mail is rejected and logged.
• Our databases are not reachable from the internet. Only our API and the sign-in page of our error store are, behind a reverse proxy; the error store accepts no new accounts, and the operator's login uses a second factor.
• Backups are kept on the same server for 30 days.

No system is perfectly secure. If a breach affects your personal information, we will notify you and any regulator as the law requires.

Children

Recoop is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 13. If we learn that we have, we delete it. Write to ops@tryrecoop.com if you believe a child has used the service.

California residents

This section also serves residents of Delaware, Nevada and every other state. The rights below are available to every Recoop user in the United States.

• The categories of personal information we collect are listed under "What we collect". The categories of third parties are under "Who processes it for us".
• You can review, correct and delete your information as described under "Retention and deletion".
• We announce material changes by email (see "Changes to this policy"). The effective date is at the top.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• No third party collects information about your activity across other websites through Recoop.
• Do Not Track / Global Privacy Control: we do not track you across sites, so these browser signals change nothing about how Recoop behaves.
• Recoop is below the applicability thresholds of the California Consumer Privacy Act. We honor the rights above voluntarily, for everyone.

Changes to this policy

When we change this policy in a way that matters — a new kind of data, a new purpose, a new recipient — we will email you at least 14 days before the change takes effect. Small edits, such as clearer wording, take effect when posted. The effective date at the top always tells you the current version. Earlier versions are available on request.

Contact

Email the operator: ops@tryrecoop.com. A legal entity and its public address will be named here before public launch.